Jeff Bezos phone hacking scandal timeline: Here’s what happened and when

It all began with a dinner and an exchange of numbers. In less than a month after Amazon CEO Jeff Bezos and Suadi Arabia’s Crown Prince Mohammed Bin Salman met for dinner, Bezos received a video on WhatsApp.

It all began with a dinner and an exchange of numbers. In less than a month after Amazon CEO Jeff Bezos and Suadi Arabia’s Crown Prince Mohammed Bin Salman met for dinner, Bezos received a video on WhatsApp. (REUTERS)

It all began with a dinner and an exchange of numbers. In less than a month after Amazon CEO Jeff Bezos and Suadi Arabia's Crown Prince Mohammed Bin Salman met for dinner, Bezos received a video on WhatsApp.

This MP4 clip that Bezos received allegedly contained malware that started siphoning off data from his iPhone. According to a report into the hack put together by FTI Consulting, the video exploited a WhatsApp bug to download and install malware on Bezos' phone, which then proceeded to ex-filtrate data from the device.

The Crown Prince's involvement in Bezos' phone being hacked was recently brought to light in the UN's analysis of the case. And in the middle of all this comes Jamal Khashoggi's brutal murder, the role of The Washington Post (that Bezos owns and where Khashoggi's columns were published) and a long history of enmity.

Here's the timeline so far. This timeline is based on a report published today by two human rights experts at the United Nations and updated with recent events.

All the events that predate and then follow the phone hack make the entire hacking accusations plausible if one factors in "Saudi Arabia's long history of targeting perceived critics of the Saudi regime with malware, which culminated with Saudi agents murdering Khashoggi in 2018".

October 2013 - Jeff Bezos buys The Washington Post.

December 2016 - Jamal Khashoggi makes critical remarks about Donald Trump's ascent to the US presidency at a Washington-based think-tank. Soon after, the Saudi regime cancels Khashoggi's column in the al-Hayat newspaper and soon bans him from writing, appearing on television and attending conferences. Khashoggi eventually leaves Saudi Arabia.

September 2017 - The Washington Post publishes Khashoggi's first column: "Saudi Arabia wasn't always this repressive. Now it's unbearable," a piece that is highly critical of Saudi's Crown Prince Mohammed bin Salman (MBS).

November 2017 - The Saudi Royal Guard acquires the Pegasus-3 spyware from the NSO Group (an Israeli company that sells surveillance tools to governments).

February 7, 2018 - The Washington Post publishes a column by Khashoggi titled: "Saudi Arabia's crown prince already controlled the nation's media. Now he's squeezing it even further".

February 28, 2018 - Khashoggi publishes another piece in the Washington Post titled "What Saudi Arabia's crown prince can learn from Queen Elizabeth II".

March 21, 2018 - Washington Post owner and Amazon CEO Jeff Bezos is invited to attend a small dinner with the Crown Prince in Los Angeles.

April 3, 2018 - Washington Post publishes another column by Khashoggi while Bin Salman is still touring the US. Khashoggi writes in this piece: "…replacing old tactics of intolerance with new ways of repression is not the answer." Bin Salman was visiting the US for a three-week cross country tour to "pitch a progressive vision for his kingdom, including an economic plan less reliant on oil".

April 4, 2018 - Bezos attends dinner with the Crown Prince, in the course of which they exchange phone numbers that correspond to their WhatsApp accounts.

(FTI Report)

(FTI Report)

May 1, 2018 - A message from Bin Salman's WhatsApp account is sent to Bezos. The message is an encrypted video file.

It is later established, with "reasonable certainty", that the video's downloader infected Bezos' phone with a malicious code. The video message is believed to be the same as the video in this tweet. The screen grab shows a picture of the Saudi Arabian flag and the Swedish flag.

(FTI Report)

(FTI Report)

After receiving the message, investigators saw a spike of data being sent from the device, a 29,000% jump in traffic, consisting of more than 6GB of egress data. Prior to the hack, Amazon's CEO had an average of 430KB/day egress data. After receiving the video, Bezos' iPhone maintained a daily average of 101MB/day in egress data for the following months, suggesting a constant state of surveillance.

May 2018 - The phone of Saudi human rights activist Yahya Assiri is infected with malicious code. Assiri was in frequent communication with Khashoggi.

June 2018 - The phone of Saudi political activist Omar Abdulaziz is infected with malicious code, via a texted link on WhatsApp. Omar Abdulaziz was in frequent communication with Khashoggi.

June 2018 - The phone of an Amnesty International official working in Saudi Arabia was targeted for infection via a WhatsApp link that was determined to lead to an NSO Group-controlled website.

June 23, 2018 - Two phones belonging to Saudi dissident Ghanem al-Masarir al-Dosari, a Saudi human rights activist and a popular political satirist active on YouTube, are targeted via a text link leading to NSO infrastructure.

October 2, 2018 - Khashoggi is killed by Saudi government officials. The Washington Post begins reporting on the murder, publishing ever-expanding revelations about the role of the Saudi government and Bin Salman personally.

October 15, 2018 - A massive online campaign against Bezos begins, targeting and identifying him principally as the owner of The Washington Post. In November, the top-trending hashtag in Saudi Twitter is "Boycott Amazon." The online campaign against Bezos keeps escalating and continues for months.

November 8, 2018 - A single photograph is texted to Bezos from the Crown Prince's WhatsApp account along with a sexist caption. It is an image of a woman resembling Bezos' current girlfriend with whom he was then having an affair. This is before Bezos' affair was known about publicly.

(FTI Report)

(FTI Report)

Febuary 9, 2019 - Bezos publishes a Medium blog post describing an attempt by the National Enquirer to extort and blackmail him with nude photos. Bezos at that point had hinted about at a connection between the National Enquirer and the Saudi government.

February 25, 2019 - The Daily Beast runs an op-ed by Iyad el Baghdadi entitled "How the Saudis Made Jeff Bezos Public Enemy No. 1"detailing" mounting evidence that the de facto ruler of the kingdom has been trying to punish Bezos for the fierce coverage of Khashoggi's murder in his newspaper.

March 31, 2019 - Hundreds of major news outlets around the world report on the allegation that Saudi Arabia had access to Bezos' phone and obtained private data. The allegation was first published in The Daily Beast op-ed by Gavin de Becker, titled "Bezos Investigation Finds the Saudis Obtained His Private Data", and is subsequently reported by the NY Times, CNN, al Jazeera, BBC, Bloomberg, Reuters and others.

April 1, 2019 - The entire Saudi online campaign against Bezos stops abruptly, strongly indicating inauthentic and coordinated hashtags and tweets.

April 25, 2019 - Intelligence officials in Norway advise el Baghdadi (The Daily Beast reporter) of a CIA warning that he is being targeted by the Saudis and move him from his home. Intelligence sources believe the threats are connected to el Baghdadi's work on Bezos.

May 1, 2019 - El Baghdadi is advised by a source in Saudi Arabia that the Saudis have successfully targeted his phone.

September 20, 2019 - Twitter suspends 5,000 Saudi accounts for "inauthentic behavior" including that of an advisor to the Crown Prince, Saud al Qahtani.

October 1, 2019 - Bezos attends the first anniversary memorial for Khashoggi held outside the Saudi Consulate in Istanbul where he was murdered. 

#Jamal pic.twitter.com/8ej1rUBXVb

— Jeff Bezos (@JeffBezos) January 22, 2020

October 2, 2019 - The Saudi online campaign against Bezos resumes after being dormant for months, specifically citing Bezos' attendance of the memorial event and again calling for a boycott of Amazon.

October 29, 2019 - Facebook sues the NSO Group in US federal court for trying to compromise the devices of up to 1,400 WhatsApp users' in just two weeks.

November 5, 2019 - The US Department of Justice charges three people with serving as Saudi spies inside Twitter. One of the three had left Twitter and gone to work at Amazon.

November 14, 2019 - Facebook confirms that "sending a specifically crafted MP4 [video] file to a WhatsApp user" is a method for installing malicious spyware - exactly as was sent to Bezos.

December 20, 2019 - Twitter suspends 88,000 accounts linked to the Saudi spying case, saying that the accounts were associated with "a significant state-backed information operation" originating in Saudi Arabia.

January 21, 2020 - The Guardian and the Financial Times publishes articles claiming the message that hacked Bezos' phone came from Bin Salman's phone number. The articles are based on a still-private report that was put together by FTI Consulting, a company Bezos hired to investigate how the National Enquirer got hold of his nude photos.

January 22, 2020 - Saudi Arabian government denies all accusations. The United Nations calls for an investigation into Saudi Arabia hacking a citizen of another country. Vice's Motherboard leaks the full FTI Consulting private investigative report. The report is available for download from here.

On the same day, New York Times reporter Ben Hubbard also claimed the Saudis targeted his phone. Hubbard stands to publish a book on Bin Salman's rise to power.

January 23, 2020 - As a response to his phone being hacked by Saudi Arabia, Bezos tweets a picture with #Jamal marking the day he visited Saudi Arabia to for Khashoggi's first death anniversary.